Description
HDNLRSVC.EXE in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System (aka AMS or AMS2), as used in Symantec AntiVirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allows remote attackers to execute arbitrary programs by sending msgsys.exe a UNC share pathname, which is used directly in a CreateProcessA (aka CreateProcess) call.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Symantec System Center Alert Management System (hndlrsvc.exe) Arbitrary Command Execution
exploit/windows/antivirus/ams_hndlrsvc
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 43099 third-party-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-11-029
- symantec-intelams2-dos(64943) vdb-entry
- 43106 third-party-advisory
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110126_01
- symantec-intelams2-code-execution(64942) vdb-entry
- 45935 vdb-entry
- ADV-2011-0234 vdb-entry
- 1024997 vdb-entry